Repository navigation
Update Routine updates - #124
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Preview |
|
Preview |
|
Preview |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
convex-hosting-hello-world-assets-only | e7bf453 | Nov 02 2026, 10:49 AM |
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 20, 2026 08:16
7aea143 to
8b393f6
Compare
commit: |
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 20, 2026 09:58
8b393f6 to
203ba7e
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 20, 2026 10:48
203ba7e to
5584ba8
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 21, 2026 02:28
5584ba8 to
570cc75
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 21, 2026 10:16
570cc75 to
5f8a8c9
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 23, 2026 03:05
2cb95bc to
5a996f4
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 23, 2026 06:43
5a996f4 to
4a9f21f
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 24, 2026 01:07
4a9f21f to
02b6cc1
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 24, 2026 20:31
02b6cc1 to
ea97ec9
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 27, 2026 00:16
ea97ec9 to
aeb1455
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 27, 2026 04:06
aeb1455 to
a3949a0
Compare
renovate
Bot
force-pushed
the
renovate/routine-updates
branch
from
October 28, 2026 00:53
a3949a0 to
69de5b7
Compare
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
5.104.2→5.105.05.105.3(+2)1.170.42→1.170.461.168.61→1.169.41.46.0→1.48.01.49.00.0.61→0.0.650.0.667.0.12→7.0.1424.21.0→24.22.1v24.22.20.0.91→0.0.920.0.9312.12.1→12.15.012.16.1(+1)12.12.1→12.15.012.16.1(+1)19.3.0→19.3.119.3.0→19.3.18.11.2→8.12.31.1.0→1.4.01.1.0→1.4.05.0.4→5.0.55.1.0v0.6.4→v0.8.04.6.6→4.6.7Release Notes
TanStack/query (@tanstack/react-query)
v5.105.0Compare Source
Patch Changes
v5.104.5Compare Source
Patch Changes
1f8d134- RecomputeuseMutationStateanduseIsMutatingresults when their filters, selector, or query client change, without waiting for a mutation cache update.f608f93]:v5.104.4Compare Source
Patch Changes
#11328
c208861- Allow queries with falsy errors to retry on mount whenthrowOnErrorreturns false.#11728
a108398- fix(react-query*): declare '@types/react' as an optional peer dependencyUpdated dependencies [
1fee044,fce89dd]:v5.104.3Compare Source
Patch Changes
0f15bc9]:TanStack/router (@tanstack/react-router)
v1.170.46Compare Source
Patch Changes
#8670
32a3360- Reference agent skills in other packages by theirintent loadidentifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.#8671
689a7c5- Publish the@tanstack/react-routeragent skills (react-router,compositions/router-query,lifecycle/migrate-from-react-router), which were missing from the package'sfileslist.Updated dependencies [
32a3360]:v1.170.45Compare Source
Patch Changes
18154b1]:v1.170.44Compare Source
Patch Changes
d6ba115]:v1.170.43Compare Source
Patch Changes
94d6d8e]:TanStack/router (@tanstack/react-start)
v1.169.4Compare Source
Patch Changes
#8670
32a3360- Reference agent skills in other packages by theirintent loadidentifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.Updated dependencies [
32a3360,689a7c5,ed55775,63a886d,d9b07e8]:v1.169.3Compare Source
Patch Changes
18154b1]:v1.169.2Compare Source
Patch Changes
71d9694,fdc10fa,923d98b]:v1.169.1Compare Source
Patch Changes
740b0ce,d6ba115]:v1.169.0Compare Source
Minor Changes
f243c61- TanStack Start is stable. To upgrade from a release candidate, follow Migrate from the Release Candidate.Patch Changes
#8694
550f478- Remove the deprecated.inputValidator()fromcreateServerFnandcreateMiddleware. Use.validator(), which takes the same validator.#7588
94d6d8e- Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped globalResponse, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it.transferResponseBodyOwnershipis removed: return the derived response directly.#7588
94d6d8e- Remove the built-inuseSessionAPI. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter throughgetCookieandsetCookie, or append serialized cookies withappendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.createServerEntrykeeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. RawcreateStartHandlerhandlers now rethrow the original error. For custom reporting, catch insidecreateServerEntry, then rethrow for default conversion or returnhandleStartError(error)to preserve response-helper status, headers, and cookies. Return an explicitResponsewhen choosing a custom error payload.Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use
appendResponseHeader('set-cookie', cookie)when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.#8696
f243c61- Require Vite 8 for Vite builds. Vite 7 is no longer supported.Updated dependencies [
94d6d8e,550f478,94d6d8e,f3d7ee3,4104b8e,94d6d8e,94d6d8e,94d6d8e,f243c61,19524cc]:convex/convex-backend (convex)
v1.48.0Convex deployments can now sign their own JWTs with an internally managed
key-pair. The
ctx.auth.signJwtAPI is available in mutations. The JWTscan be verified with the public key in the JWKS hosted at
${CONVEX_CLOUD_URL}/.well-known/jwks.json.npx convex dev --verboseandnpx convex deploy --verboseno longer printenvironment variable values. The logged list of environment variables shows
every value as
<redacted>, and values of 8 or more characters are alsoredacted wherever else they appear in the logged push response and diff, such
as auth providers that
auth.config.tsbuilds fromprocess.env.When an AI agent runs
npx convex env listornpx convex env default list,they now list only names by default, so secrets stay out of the agent's
context. Agents are detected from the environment variables they set. Pass
--include-valuesto print the values.Fixed
npx convex ai-files installandnpx convex ai-files updatereportingsuccess and exiting 0 when the guidelines download or the agent skills
install failed. They now exit with code 1.
ctx.storage.store()andctx.storage.get()are now available in mutations,not just actions. Files stored and read in a mutation count toward its
transaction limits.
v1.47.0npx convex project create. It suggestednpx convex deployment create <team>:<project>:dev --type dev, which alwaysfailed because
devis reserved for your default dev deployment. It nowsuggests a
dev/my-featurereference and passes--select.npx convex deploynow asks for confirmation before creating or changing anindex on a large table, since the deploy blocks until the index is backfilled.
Stage the index (
staged: true) to backfill it in the background instead, orpass the new
--skip-large-indexes-checkflag to proceed withoutconfirmation. That flag also covers deleting large indexes, replacing the
hidden
--allow-deleting-large-indexesflag, which keeps working.envListMCP tool now returns only environment variable names by default,so secrets stay out of the agent's context. Pass
includeValues: trueto getthe values too, or use
envGetto read a single variable.npx convex env listandnpx convex env default listhave a new--include-valuesflag for printing values explicitly. Values are stillprinted by default. The docs and help text now use
--include-valueswhereverthe values are needed, like
npx convex env list --include-values > .env.convex, and--names-onlyforjust listing variables.
.staged()todefineTablefor validating a schema change in thebackground instead of blocking the deploy on a scan of the table. Pass the
fields to add or change, set a field to
undefinedto remove it, or pass afull validator. The current validator stays enforced while Convex checks
existing documents and new writes against the staged one.
npx convex deployand
npx convex deploy --dry-runreport each staged table as validating,validated, or failed, and the dry-run warning about scanning large tables now
suggests staging the validator. Once a staged validator is validated, moving
it into
defineTabledeploys without scanning the table. A deploy that woulddiscard pending or completed staged validation asks for confirmation; pass
--allow-unstaging-schemato skip the prompt in CI. Seehttps://docs.convex.dev/database/schemas#staged-validators.
ctx.meta.getSnapshotTs()is now public API. It returns the databasetimestamp of the snapshot the current function reads from, in nanoseconds, on
the same clock as
db.vars.commitTs. Seehttps://docs.convex.dev/database/advanced/commit-timestamp.
convex/serverexportsgetServiceUrl, which returns the base URL of aConvex-managed service such as the AI gateway, to pair with
getServiceToken,along with a
ServiceNametype. The client no longer rejects service names itdoesn't know about, so libraries can adopt new services without requiring a
newer
convexversion.value is expected. It now names the unsupported type and its path, like
Function "[Function]" is not a supported Convex typeat.cb, instead ofthrowing
Cannot read properties of undefined (reading 'length').auth.config.tsisnot set on the deployment, the CLI now prints the
npx convex env setcommands to run and a link to the deployment's environment variable settings.
npx convex deployment create --regionaccepts the Canada(
aws-ca-central-1) and Asia Pacific (aws-ap-southeast-2) regions. Seehttps://docs.convex.dev/production/regions.
npx convex deployment usage-limits set --metric aiGatewayCostDollarssetsthe AI gateway spending limit.
convex/convex-test (convex-test)
v0.0.65Compare Source
ctx.auth.signJwtAPI.v0.0.64Compare Source
.paginateand mutations can paginate multiple times.v0.0.63Compare Source
Date.now(),Date(), andnew Date()for each query or mutation,including nested calls and
t.run. Like the Convex backend, the pinned timeis at or after the transaction's snapshot timestamp and at or before the
_creationTimeof documents the transaction inserts. Scheduled functionsstill become due according to the wall clock, as in the real Convex backend.
(#144)
pagination, including candidates excluded by post-search filters. Queries
can stop early with
.take(), smaller pages, or an early exit from iterationto stay within the limit. (#169, #171)
unregistered component, with an error that explains how to register it and
lists the registered components. (#164)
_storagemetadata. (#170)v0.0.62Compare Source
kaelzhang/node-ignore (ignore)
v7.0.14Compare Source
v7.0.13Compare Source
nodejs/node (node)
v24.22.1: 2026-10-21, Version 24.22.1 'Krypton' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel)0ed4268(Evgenii Kliuchnikov)Commits
2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #668774d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#9874b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#10079243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #664961e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #6686849dff6f57a] - deps: brotli: cherry-pick0ed4268(Evgenii Kliuchnikov) nodejs-private/node-private#1002fca511adc5] - deps: V8: backport93cd21e(Joyee Cheung) nodejs-private/node-private#100818711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #663961d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #66764843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#98496c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#9838dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973b5f41529df] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#100201acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #66871935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#9859dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855v24.22.0: 2026-10-14, Version 24.22.0 'Krypton' (LTS), @richardlau prepared by @aduh95Compare Source
Notable Changes
ddbf974b47] - (SEMVER-MINOR) crypto: addcrypto.parsePKCS12()(Brian Muenzenmeyer) #65627c162c68ff0] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553a4ab3d84d7] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484c2f1e829ea] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #6548451aad5a80d] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411d11c65d2f2] - doc: add araujogui to collaborators (Guilherme Araújo) #66090acc1578179] - doc: deprecateServer.prototype._listen2innode:net(Antoine du Hamel) #65593a7f8de6362] - (SEMVER-MINOR) net: support sendingnet.BoundSocketto threads and child processes (Guy Bedford) #6472560c3eb61bd] - (SEMVER-MINOR) perf_hooks: implementSlidingWindowHistogram(James M Snell) #658256b3e6f9d5c] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #6580675456a3512] - (SEMVER-MINOR) perf_hooks: implement HistogrammeanCIAPI (James M Snell) #6560672d1b40c56] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #6543441161dda87] - (SEMVER-MINOR) sqlite: addStatementSync.prototype.close()(Guilherme Araújo) #64232adbc757d70] - (SEMVER-MINOR) sqlite: addStatementSync.prototype[Symbol.dispose]()(Guilherme Araújo) #64232241339f072] - (SEMVER-MINOR) src,lib: addutil.markPromiseAsHandled(James M Snell) #6580563b0974d9e] - (SEMVER-MINOR) util: implementutil.throttle(James M Snell) #65899a3bbb5a26f] - (SEMVER-MINOR) util: implementdebounce(James M Snell) #65899Commits
e6832b2cb1] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449a079177d9f] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #6592210b1a0f70f] - benchmark: fix max-regressions detection in compare.js (James M Snell) #65587e0c7ba8ad5] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #6559421fed10bb0] - benchmark: add crypto class benchmarks (Filip Skokan) #65518fa912242b7] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #65905a6bd0c1413] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #6602394e12139ee] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #657447a2f322943] - build: fix quiet default for make builds (Shelley Vohr) #65826c280d650b0] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #657974b23a4472c] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237676e15c003] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464f784058482] - build: remove obsolete configure flags (Chengzhong Wu) #65456f63f37d243] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708da46ac075d] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491249e9a16dd] - build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY (Piotr Kubaj) #66082146f00f64b] - child_process: clear timeout timer on spawn-time error too (kishore280) #6550613987f4418] - crypto: remove redundentstd::movecall (Antoine du Hamel) #66111ef957ac85f] - crypto: skip private RSA parameters in key details (Filip Skokan) #661088feccc5e22] - crypto: use provider EC group names (Filip Skokan) #66108764e0d1120] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #6610850ffed1979] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #6610856c16b2fd6] - crypto: derive keys through EVP_KDF (Filip Skokan) #66108a4effe6809] - crypto: use names for asymmetric key algorithms (Filip Skokan) #65966ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #656278e631aa48f] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #657595c51129e16] - crypto: optimize private EC JWK import (Filip Skokan) #65908c2ec40c2d7] - crypto: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) #65172e198aa0f79] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #66108253784f0e9] - crypto: optimize and benchmark key preparation (Filip Skokan) #6589280a6ad509b] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #659085b592b772c] - crypto: avoid EC raw export reconstruction (Filip Skokan) #65908ee956ae3bf] - crypto: export EC JWK coordinates directly (Filip Skokan) #65908684008be58] - crypto: read EC curve metadata directly (Filip Skokan) #65908f4665f1c41] - crypto: validate the limit of PBKDF2 iterations (Filip Skokan) #65704624abbecd7] - crypto: use primordials in HKDF info validation (Filip Skokan) #65704e4d916f175] - crypto: add mgf1Hash for RSA-OAEP (Adam Mcgrath) #65073db8a9162a8] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #65649022ac83504] - crypto: cache valid ECDH key pairs (Filip Skokan) #65615c61953ebcc] - crypto: add strict mode to --force-fips (Filip Skokan) #65645db6ea132a5] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #65645c162c68ff0] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #655532b62aafd20] - crypto: validate JWK usages before key_ops (Filip Skokan) #65550ec7819db69] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #65550a4ab3d84d7] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484c2f1e829ea] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #6548451aad5a80d] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #634115a46a9acbb] - crypto: improve SubtleCrypto.supports() accuracy (Filip Skokan) #65222191ebfb26c] - crypto: fix public PKCS8 export error (한국) #65609b6d7ed372b] - crypto: fix private SPKI export error (Filip Skokan) #6555079509c25a4] - crypto: correct CCM decryption FIPS error message (kyungrae) #654509adc87bc16] - crypto: harden X509Certificate state (Filip Skokan) #65518c63aa331b4] - crypto: optimize key slot caching (Filip Skokan) #6551887daea43a7] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #6345798ca5e9358] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #651120c090a28cd] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #65503a13cc3f723] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #65503b8db0045ef] - deps: V8: cherry-pickea9c016(Gundepalli Sravani) #66570ba09b53487] - deps: V8: backportc355350(Jakob Linke) #660899ce8ef405b] - deps: V8: backport8901c79(Toon Verwaest) #66089fb0d0ca289] - deps: V8: backport0b94a9f(Ruan Gustavo) #657532faca508c0] - deps: update googletest to8eff9e3(Node.js GitHub Bot) #660094396c9bffe] - deps: update googletest to [283c175](https://redirect.github.com/nodejs/node/commit/283c1Configuration
📅 Schedule: (in timezone Europe/Chisinau)
* * * * 1-5)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.